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FLTOIT TEST RESULTS OF THE STRAPDOWN HEXAD INERTIAL REFERENCE UNIT (SIRU) 

VOLUME I: FLIOTT TEST SUMMARY 

Ronald J. Hruby and William S. Bjorkman* 

Ames Research Center 


SUMMARY 


A flight test program was conducted by NASA Aires Research Center to eval- 
uate the performance of the redundant, modularized, fault-tolerant Strapdown 
Inertial Reference Unit (SIRU) in an aircraft environment. The results of the 
flight test program are described in three volumes. This document. Volume I, 
summarizes the findings of the program. Volume II contains a detailed descrip- 
tion of the flight test program and its results. Volume III contains appen- 
dixes which expand on relevant particulars of the SIRU system and the flight 
test program. 

The principal flight test objectives included assessment of: 

1. SIRU system performance as an unaided inertial navigation system 

2. Capability of system redundancy management software to detect sensor 
failures 

3. Flight performance of the dual conq>uter configuration 

The results of 15 separate flights showed that the unaided inertial navi- 
gation accuracy during cruise was better than 3 n. mi. /hr error growth. During 
terminal area maneuvers, these errors were less than 5 n. mi. /hr. Such error 
growths are tolerable for short-haul operation where flight times are short 
and where radio navigation updates are available. Additional analysis, 
design, and testing would reduce these error growths further. Updating the 
inertial data with recorded Distance Measuring Equipment (DME) readings (post- 
flight) enabled the theoretically aided system to bound the error within 
0.2 n.ml. 


The flight test showed that with the existing SIRU design it was possible 
to isolate gyro failures equal to or greater than 1.6®/hr. A detection thresh- 
old set to detect failures less than 1.6® /hr would result in excessive false 
alarms. A gyro failure of 1.6® /hr is considered to be a hard failure from the 
standpoint of unaided navigation. From the standpoint of flight control, it 
represents a very soft failure. 


*Senior Analyst, Analytical Mechanics Associates, Inc., Mountain View, 
California. 


The fault detection and isolation algorithms are the area in need of moat 
research for the overall SIRU concepts to become operational in aircraft. The 
SIRU dual computer system provided both reliable and correct information. 
However, several design improvements which could improve the overall reliabil- 
ity and maintainability of a future system are suggested. 


INTRODUCTION 


Current avionics systems employ numerous sensors, actuators, and display 
devices for various flight modes. These systems often overlap in function, 
and therefore, a limited degree of control and navigation reliability is pro- 
vided by this redundancy. However, redundancy, when implemented, nK)st often 
provides reliability by way of hardware duplication. For example, in commer- 
cial aircraft application, where inertial navigation system reliability is 
considered necessary for operational success, redundancy has been implemented 
by triplicate systems. An integrated, redundant, avionic implementation with 
self-contained fault identification and adaptation capabilities is clearly 
needed for future aircraft operations to eliminate unnecessary backup config- 
urations (ref. 1). Advances in sensors and semiconductor technology, coupled 
with advances in redundant navigation, guidance, and control computer algo- 
rithms, have made possible the Strapdown Inertial Reference Unit (SIRU). The 
SIRU is a redundant, iiK>dularized, fault- tolerant system originally developed 
for space applications by the Charles Stark Draper Laboratory under Contract 
NAS9-8242 with NASA Johnson Space Center (refs. 2 and 3). Under Contract 
NAS2-7439 with NASA Ames Research Center, the original laboratory mechanization 
was modified to provide a flightworthy, redundant navigation system installed 
in the NASA Convair 340 (CV-340) aircraft (refs. 4 and 5). The SIRU Flight 
Test Program was undertaken by NASA Ames Research Center to evaluate SIRU in 
an aircraft flight environment. The primary goal of the SIRU Flight Test Pro- 
gram was to develop a baseline for the performance of an integrated guidance, 
navigation, and flight control system for short-haul aircraft. 

The SIRU Flight Test System is a free- inertial (unaided, dead-reckoning) 
navigation system consisting of a strapdown hexad inertial sensor array and 
dual computers. The sensors consist of six slngle-degree-of-freedom integrat- 
ing gyros and six linear accelerometers. The six sensing axes of the inertial 
sensor array lie along the normals to six nonparallel faces of an imaginary 
dodecahedron illustrated in figure 1. Each axis contains one integrating rate 
gyro module (TRIG 16 MOD B) and one accelerometer module (16PM PIP MOD B). 

The SIRU dodecahedron configuration and redundancy management software 
permit the navigation system to function when any three gyros and any three 
accelerometers are operational. This is contingent upon faulty sensors being 
detected and removed. When sensor failures are detected and the faulty sensor 
Identified (isolated), outputs of the faulty sensors are excluded from the 
computation of position, velocity, and attitude by system software. The sys- 
tem continues to function with the remaining sensors. The modular features 
embodied in the SIRU system include prealigned, normalized, interchangeable 
assemblies in which each instrument is integrated with its own torque loop and 
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teiq>erature controller. The remaining electronics are located in interchange- 
able modules* by axis, in the electronics assembly section. The modular fea- 
ture enhances system maintenance repair and line replacement unit capability. 

It should be noted that the gyros used in the SIRU are experimental 
precision- floated gyros. These gyros are not strong candidates for strapdown 
applications in short-haul aircraft because of high cost, warmup time 
required, and calibration requirenffints . However, much of the functional soft- 
ware and many of the redundancy management techniques evaluated in this pro- 
gram are generic to strapdown navigation systems in general and provide a 
basis for further investigations using other sensor concepts, such as laser or 
tuned rotor gyros. 

SIRU was exercised in a laboratory environment from July 1970 through 
July 1974, prior to the adaptation of the SIRU instrument package for flight 
tests. Fifteen flight tests of the SIRU system were made in NASA's CV-340 
aircraft between May 20, 1975 and September 24, 1975. The flight test system 
had a digital tape recorder for recording flight test data on magnetic tape 
and plasma information displays. The installation of SIRU in the CV-340 is 
shown in figure 2. 

Several navigational references were utilized in the flight test program 
to evaluate navigational performance. In addition to the two Nike-Hercules 
radars operated by NASA at the Crows Landing NALF test facility, the test pro- 
gram utilized (a) multiple station DME data from a digitally tuned DME 
receiver, (b) optical waypoint position fixes taken on landmarks with a drift- 
meter and recorded by camera, and (c) surveyed position bench-marks with lati- 
tude and longitude used as external references. Barometric and radar altitude 
were also measured and recorded in flight. The position references were not 
used in the free-inertial navigation computations except for initialization 
purposes. 

This summary document discusses the primary objectives of the flight test 
program, describes the flight test program and the aircraft position reference 
system, and summarizes the flight test results, including navigation accuracy 
performance of the failure detection and isolation algorithms, and hardware 
and software limitations. 


SIRU FLIGHT TEST OBJECTIVES 


The broad goal of the SIRU Flight Test Program was to explore the feasi- 
bility of achieving low-cost, highly reliable, short-haul navigation, guidance 
and control through application of strapdown inertial systems technology and 
redundancy management techniques. This goal was attained by flight testing 
the SIRU system in the NASA Ames CV-340 aircraft. This evaluation provided a 
performance baseline for future Integrated strapdown, redundant-component air- 
craft guidance, navigation, and flight control systems. The tests also pro- 
vided the basis for projecting navigational performance, fault detection, and 
isolation threshold requirements for aircraft flight control and navigation. 
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The principal flight test objectives included assessir^nt of: 

1. System performance as a skewed^sensor , free-inertial navigational 
system* as evidenced by navigational accuracy achieved in the flight tests 

2. System capability to detect and Isolate sensor failures by way of 
redundancy management software 

3. The performance of the dual computer configuration and its compati- 
bility with the hexad sensor redundancy concept 

The last objective included combining the flight results with laboratory 
results (refs. 5 and 6). Secondary objectives of the test program Included 
(a) the determination of DME and Nike-Hercules radar accuracies for calibra- 
tion of the aircraft position reference system* (b) development of data reduc- 
tion procedures, and (c) an assessment of SIRU’s inertially smoothed radio 
navigation potential. 


FLIGHT TEST PROGRAM DESCRIPTION 


The SIRU Flight Test Program began May 20* 1975, and ended on Septem- 
ber 24, 1975. Several acceptance flights were made earlier at Hanscom Field* 
Massachusetts, near Boston (ref. 5). A total of 15 flights was made, with 
3 devoted entirely to assessment of cruise navigation performance. 

All flights were made in California’s San Joaquin and Salinas Valleys, 
shown in figure 3. The landmarks (waypoints) used for visual calibration of 
the reference system are depicted in figure 3. In general, triangular courses 
were followed with Crows Landing used as the central* calibrated waypoint. 

The largest segmented courses included Sacramento, Modesto* Salinas, Moffett 
Field, and Oakland as waypoints. 

Two types of flight test patterns were flown: enroute (Moffett to Crows 

Landing and return), and terminal area (in the vicinity of Crows Landing). 

The enroute patterns were similar to the one illustrated in figure 4. This 
shows takeoff from Moffett Field, turning to fly over the Moffett DME for a 
taoe mark, flying over the San Jose DME for another tape mark* flying over 
Lick Observatory for a visual mark, overflying the Crows Landing DME for a 
final tape mark, and then landing. Portions of each of the flights were 
utilized for test calibration and system adjustments. Most flights were made 
below 3000-m (10,000-ft) altitude. Cruise flights were of sufficient length 
to record one or more complete Schuler periods. 

Terminal area maneuver tests followed a flight profile similar to the one 
illustrated in tigure 5. The flight tests generally combined both enroute and 
terminal segments. 

A typical flight sequence originating at Crows Landing after a fine 
alignment is shown in figure 6. In this flight, the CV-340 left Crows Landing, 



crossed Stockton, Modesto, Castle AFB, Merce^, and finally turned back to 
Crows Landing. At each waypoint, a visual calibration was made by using the 
driftmeter and marking the time of passing runway reference points. The time 
of the waypoint mark was automatically recorded on the magnetic tape for post- 
flight correlation with the SIRU and reference system's data* 


Position Reference System 

The position reference system used during the SIRU flight tests to track 
the CV-340 aircraft consisted of three primary references: (a) the NASA radar 

tracking system at Crows Landing NALF, California, (b) a multiple DME system 
TOunted within the aircraft, and (c) time-referenced photographs of airport 
reference benchmarks taken periodically from the CV-340 throughout each flight. 
The radar tracking system consisted of two modified Nike-Hercules radar sys- 
tems* The awdification provided Improved resolution through the use of 19-bit 
range and angle digital shaft encoders. No atmospheric refraction correction 
was provided. A transponder aboard the CV-340 was used to improve angle 
tracking. 

The multiple DME receiver system provided range information from as many 
as six DME stations. The system utilized a fast-switching DME receiver which 
was automatically programmed to scan sequentially for each of six selectable 
DME frequencies. Range lockup time was 1 sec maximum, and range output reso- 
lution was 18.5 m (0.01 n. mi«). 

Photographs of reference landmarks were taken from the aircraft by a 
camera mounted on a standard military driftmeter installed in the underside of 
the aircraft fuselage. The positions of the driftmeter and multlple-DME sys- 
tem within the CV-340 are Illustrated in figure 2. The time point at which 
each photograph was taken was recorded in the SIRU digital tape recorder in 
order to correlate with radar and DME position data. The number of photo- 
graphs per flight varied from 8 to 16 depending upon the length of the flight. 
The driftmeter' s level gyro was inoperable during most of the flight tests, 
thus introducing a small amount of uncertainty in the aircraft position as 
determined from the photographs. 

The relative accuracies of the different methods of locating the aircraft 
position are summarized in table 1. This table lists the rms residuals 
obtained from combinations of radar/photograph (driftmeter), DME/photograph, 
and radar/DME. The residuals listed in table 1 are much sr "Her than the SIRU 
navigation errors sustained during the flight tests. 

TABLE 1.- POSITION REFERENCE SYSTEM RMS RESIDUAL SUMMARY 
Average residual, m 

Radar photograph DME photograph Radar DME 
135.23 220.19 218.65 


The software for analyzing the SIRU flight test data, using the Ames IBM 360 
and CDC 76<K) computers, is presented in Volume II of this report. 
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FLIGHT TEST RESULTS 


Summary 

The flight tests Included multiple segments in which each segment pro- 
duced a taagnetic tape of recorded SIRU test data. In most cases, SIRU was 
fine-aligned between segments, so that each such segment could be considered a 
separate flight test. Thirty-four segments were flown, producing about 36 hr 
of navigation data. Commentary on individual flights is found in Volumes II 
and III of this report. 

Figure 7 depicts the in-fli^t duration, navigation loode duration, and 
radar coverage for the 15 flight tests; the flight date appears on the left of 
the figure. Each flight segment is represented by an unbroken horizontal line. 
Later segments are shown relative to the zero time point of the first segs^nt 
for each multisegment flight. Navigation duration for any segment is indi- 
cated by the length of the segment's unbroken line* The darkened portion of 
tho line indicates time in flight, vith ”T” denoting takeoff and "L** denoting 
landing. Radar coverage periods are indicated by parenthesized line segments 
just above the navigation segments. Observe that 12 of the 15 flights had 
some radar coverage. DME coverage, although of less accuracy than radar 
coverage, was present in almost unbroken fashion for every flight test segment. 

Table 2 summarizes characteristics of the Ames Research Center flight 
tests. Navigation mode and flight duration (in seconds) are listed after a 
brief description of the route flown by the CV-340. "Radar intersection" is a 
tabulation of the total tin^ Interval during which there are data concurrently 
on both the SIRU and radar tapes. The column headed "Marks" contains the 
number of position fixes taken and recorded; "Computers" identifies which 
computers were recorded and whether they differed when both were recorded; 
"Rate" denotes whether raw sensor data were recorded at the high rate "H" 

(20 Hz) or the low rate "L" (1 Hz). 

Maximum position error is shown in nautical miles and, in most cases, 
refers to the DME-derived position, which was assumed to be correct. The 
maximum error usually occurred at the end of the recorded segment* It should 
be noted that some tests were flown without particular concern for naviga- 
tional accuracy and that operational mistakes are Included with the "errors." 

Detected failures are listed in the last two columns of table 2. Fail- 
ure, in the context of this report, means that the performance of a given 
instrument, gyro or accelerometer, exceeded a predetermined limit that had 
been established in the failure detection software. Unscheduled failures are 
those which were unintentional, while scheduled failures were caused by inten- 
tionally mlscompensating the sensors at some point in flight. The notation 
"G(FCBDEA)," for example, indicates that every gyro failed at some time during 
the test, the order of failure being first F and finally A. The notation A(D) 
means that only accelerometer D failed during the segment. 
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TABLE 2.- FLIGHT TEST SUMMARY 


rui^t 

data 

Route 

Mavigac ion 
duration, 

sec 

night 

duration, 

sec 

Radar 

InCcrsection, 

sec 

Narks 

Costputers 

Kate 

Naxinun 

position error, 
n. ni. 

Detected 

Unscheduled 

(s) 

failures 

Scheduled 

<s> 

5^20 

Nof fett/Crowa 

3170 

2230 

1655 

6 

1 

L 

3.93 

c(cr> 


3/ JO* 

Moffett /Crows 

2W0 

1213 

0 

1 

1 

H 

12.82 

CCFCIOCA), 

A(A) 


3/3<M 

Crews/Los lano«/Hof feet 

3MO 

*310 

2215 

23 

1 

H.L 

*1.02 

CICFAICD) 

— 

6/lbA 

Nof fete /Crows 

307* 

1601 

0 

11 

A-B 

L 

23-08 

C<FC£AK». 
A (AO) 

- 

b/161 

Crows /Noffett 

2321 

1670 

0 

8 

A-B 

L 

3-53 

r.(AlFCCD>. 

A(E) 

— 

ft/IB 

Noffett/Sec./ltoffetC 

133D3 

1*115 

0 

30 

A 

L 

33.99 

CCEACBF) . 
Ad) 

— 

*/2S 

Crows/Crows 

3*05 

2*50 

32*2 

10 

A-B 

R 

12.9* 

G(C»BA)A(D) 

— 

2/U 

No f f et t /S t4>ckC<m /No f Cet t 

1005 

*323 

0 

11 

1 

H 

35.59 

C(BOACr) 

— 

J/17A 

Nof f ett /Stockcem 

5t50 

*000 

1020 

1* 

A 

H 

*-*0 

— 


7/171 

Stocktoft/Nof fete 

*155 

3125 

3015 

12 

A 

H 

2-10 

— 

G<CA) 

7/24A 

lb»f fete /Crows 

2*00 

1205 

35* 

6 

A»B 

H 

2.79 



.... 

7/241 

C rows /Stock t on/C rows 

2555 

2163 

2447 

5 

A-B 

M 

1.2) 



A(CE> 

7/24C 

Crows/Stockton/Crows 

2517 

22*1 

2417 

6 

A-B 

H 

*.o* 


A(CA),A(C) 

7/21A 

Nof fett/Stockcon/Crows 

>171 

3*30 

317* 

9 

A-B 

M 

1*.06 

c(rBC) 

C(d>) 

C(0* 

7/2n 

Crows /Noffett 

2*21 

1312 

1*61 

8 

A-l 

B 

7.1) 

C(C) 

S/22A 

Nof fett/Crowa 

2130 

im 

333 

7 

A-B 

R 

2.93 





1/221 

Ctos*s /C rows 

2110 

1*6 

2031 

6 

A-l 

N 

-36<^ 

C(E),A(C) 

C(Ai> 

1/22C 

Crows /Bakersfield 

*002 

3*22 

2366 

3 

A-l 

VR.L 

11.16 

C(EF).A<C) 

C(AB> 

l/22n 

kakersfleU/Hoffett 

-- 

*320 


6 

A 

R 

— 

C(E).A(A) 


1/2U 

Noffett /Crows 

2120 

1202 

830 

6 

A-B 

H 

7.63 


C(BA) 

1/21A 

Crows /Crows /C rows 

2501 

353 

2316 

3 

A-B 

N 

.3' 

... 

CCBA) 

1/OlA 

Hof feet /Crows 

2200 

1231 

0 

6 

A-B 

II 

2.50 

C(A) 

C(It) 

1/031 

CroMs/Crows 

3017 

1110 

177* 

2 

A-l 

H 

3.72 

C(D 

ACM* 

1/03C 

Crows/Crows 

2)31 

1*M 

1*0* 

2 

A-l 

M 

1.16 

C(F) 

C(E3 

1/030 

Crows/Noffett 

2053 

1361 

lil7 

6 

A-l 

R 

3.00 

c(cr> 

A(DC> 

1/lOA 

Noffect/Crows 

3750 

2*67 

1758 

* 

A-B 

H 

3.17 




1/101 

Craws/Crows(A cofit’d) 

2527 

171* 

2363 

5 

A-l 

K 

10.19 

C(B) 



1/lOC 

Crosfs/Crowsd cont'd) 

2132 

1152 

2*59 

6 

A-l 

H 

11.36 


— 

1/lOD 

Crows/Moffetc(C cont'd) 

1131 

1117 

0 

* 

A-l 

H 

20.1* 



1/llA 

Noffect/Crows 

31M 

2110 

2173 

4 

A-B 

H 

6.22 



— 

1/UB 

Cro%rs/Crows<A coet'd) 

30*5 

2*15 

304 5 

3 

A-B 

H 

7.62 





1/llC 

Crows/Crows<l cont'd) 

2110 

2*67 

2*10 

5 

A-B 

H 

6.11 





1/lAD 

Crows/Noffett 

1600 

1011 

1^04 

3 

A-B 

M 

2.11 

C(FC).A(E) 

— 

1/24 

Nof fett/Baker/Nof feet 

15811 

U2H 



21 

A-B 

t 

7.8 




*It ihould b« not«4 that th* nuntrcr of fai tunes throujth "W'lit of tK« early flight* were rauscil by low TSf Halts ooJ |iro-> 

cedural probloaa. During later flights, sotwn^ '.mskheduH'd f.illures were detected and rescvlutlofi of t1i« cause not detensined. 
ClFCiOCA) indicates gyros F, C, B. D. I, and A f.iiied in (Hat ordiei . AiAt indicates acceleroaeccr A failed, etc. 


^Snalt failure undetected (bel^nu delei. t i i:m . 

*‘PoaItto« and velocity were re-jiet durin.ii; navigation. 



Navigation Accuracy Raaulta 


Navigation accuracy waa evaluated by comparing the indicated position 
with a position independently derived from one of the external position refer- 
ences at the same computer frame time. 

Except for occasional bad data intervals, the external position references 
were in good agreement during the SIRU test program. Discrepancies from the 
references were small relative to the system navigational error. In each 
instance where the B con^uter differed from the A computer (by the insertion 
of scheduled failures into B and not into A) , the navigational error estimate 
from the better computer (A) was used in performance calculations. 

Table 3 summarizes navigation performance during the flight test program. 
The maximum position error (residual) appears after the flight date and navi- 
«*.-«tlon duration coluons. This maxinaim error does not necessarily occur at the 
end of the navigation segment because the navigational error does not grow 
linearly with time. In an attest to represent the navigational error as a 
simple function of time, the navigation error was "fitted" by the least- 
squares method to: 

1. a constant (the average, shown in column 4 of the table) 

2. a straight line through the origin (slope is shown in column 5> 

3. a straight line (error • a + bt, as shown in column 6, b in column 7) 

The data in table 3 show generally improved navigational performance with time 
into the test program, and wide variations in navigational performance 
between segments of particular flights. 

On the basis of table 3, system navigational accuracy rating at the end 
of the test program was about 3 to 4 n. ml./h.: although flight 9/24 indicated 
1.02 n. mi. /hr. The wide variations between same-day segments were due to 
alignment uncertainties and human error because bias and scale-factor sensor 
output correction were common among these segments. The variations were also 
caused by the effects of different maneuvers on dynamic sensor conqiensations. 


Failure Detection and Isolation (FDI) Algorithm Performance 

The SIRU failure detection algorithm is based upon computing the sum 
total of the squared error (TSE) of each inertial sensor type and comparing it 
against a dynamically changing threshold called maximum allowed squared error 
(MASE). When the TSE exceeds the threshold by a certain ratio, a sensor fault 
is indicated. Setting the threshold too low can lead to predictable but false 
"failures" during certain aircraft maneuvers. Setting the threshold too high 
can lead to undetected but real sensor failures. The selected threshold 
values were a function of quantization of sensor output, digital system noise, 
and aircraft maneuvers. Details of this algorithm can be found in Volume II 
of this report. The failure detection algorithms were executed at each 
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TABLE 3.» SIRU MAVIG4TI0H PERFOEMAHCE 


Flight 

date 

Navigation 

duration, 

sec 

Maxiiaum 
position 
error, 
n. ml. 

Average 
position 
error, 
n. sd. 

Average 
slope, 
n. ai./hr 

Straight line (a+ht) 

a, b, 

n. ni. n. ml. /hr 

5/20 


5,171 

5.93 

3.19 

4.61 

-0.02 

4.65 

5/30A 


2,380 

12.82 

4.47 

9.80 

-12.31 

34.56 

5/30B 


5,980 

41.02 

17.76 

20.77 

-6.56 

26.59 

6/16A 


3,074 

23.08 

12.30 

29.61 

-2.95 

34.73 

6/16B 


2,321 

3.55 

.81 

2.70 

-.15 

3.06 

6/18 


15,303 

33.99 

12.60 

5.49 

4.39 

3.90 

6/25 


3,405 

12.94 

7.63 

15.58 

1.07 

13.86 

7/14 


6,005 

35.59 

15.65 

19.79 

-3.77 

23.27 

7/17A 


4,888 

4.40 

2.52 

2.94 

.53 

2.44 

7/17B 


4,155 

2.10 

1.02 

1.22 

.45 

.77 

7/24A 


2,400 

2.79 

1.21 

3.64 

-.01 

3.67 

7/24B 


2,555+ 

1.23+ 

.36 

.97 

.04 

.88 

7/24C 


2,587+ 

4.04+ 

1.48 

4.35 

-.62 

5.63 

7/29A 


4,900 

14.06 

8.53 

10.50 

-1.88 

12.50 

7/29B 


2,426 

7.13 

1.76 

6.14 

-1.32 

9.09 

8/22A 


2,630 

2.93 

1.38 

3.94 

-.24 

4*44 

8/22B 


2,110 

.36 

.31 

.84 

.27 

.14 

8/22C 


4,082 

11.16 

2.22 

4.81 

-.92 

6.20 

8/22D 


1 

? 

? 

? 

? 

? 

8/29A 


2,620 

7.65 

2.10 

6.65 

-1.48 

9.71 

8/29B* 


2,501* 

.3* 

.15 

.36 

.12 

.11 

9/05A 


2,200 

2.50 

1.06 

3.56 

-.10 

3.81 

9/05B 


3,067 

3.72 

1.05 

2.73 

-.53 

3.66 

9/05C 


2,013 

1.86 

.60 

2.25 

-.16 

2.68 

9/05D 


2,053 

3.00 

.73 

4.13 

-.57 

6.22 

9/lOA 


3,733 

3.97 

1.19 

2.36 

-.20 

2.65 

9/lOB 


6,685 

10.19 

4.40 

5.32 

-1.92 

6.86 

9/ IOC 


9,620 

19.36 

6.70 

5.37 

-1.66 

6.29 

9/lOD 


12,130 

20.14 

8.16 

5.15 

-.85 

5.53 

9/18A 


3.860 

6.22 

2.22 

4.52 

-.96 

5.85 

9/18B 


7,345 

7.62 

4.00 

3.85 

.34 

3.61 

9/18C 


10,7(K) 

6.88 

4.33 

2.59 

2.03 

1.57 

9/18D 


1,600 

2.91 

.95 

4.79 

-.54 

6.61 

9/24 


15.819 

7.80 

3.92 

1.59 

1.68 

1.02 


Position reset at 1300 sec. 
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inertial data (gyro or acceleroacier) update point to enable "failed" Instru- 
nenta to be taken off-line without causing excessive perturbation to the com- 
puted aircraft attitude or velocity. For the flight test program, the SIRU 
update rate was 20 times per second. 

Scheduled sensor "failures" were imposed on 11 of the flight test seg- 
Mnts by purposely mlscoopensatlng a sensor's null bias. Table 4 suonarlses 
the reaulta of the recorded in-flight scheduled failure tests of the FDI capa' 
billty. The level of failure shown is the amount by which the null blao of 
the sensor was shifted in the tesr. The levels shown in the table are from 
Draper Laboratory flight records which were not recorded on the flight tape. 


TABLE 4.- SCHEDULED FAILURE PgTECTION/ ISOLATION TEST RESULTS 


Flight 

segment 

Flight 

cond. 

(a) 

Failed 

sensor 

Failure 

level 

Time 

in 

sec 

Time 

detected 

sec 

Undetected 

duration* 

sec 

Error, 
6Ang, 6V 

TTitb 

SL 

C gyro 

5Vhr 

807 

866 

‘59 

0.082* 


M 

A gyro 

10* /hr 

1267 

1300 

33 

.092* 

7/24B 

SL 

C accel. 

2 cm/sec^ 

1628 

1648 

20 

.40 m/sec 


SL 

E accel. 

3 cm/sec^ 

2102 

2123 

21 

.63 m/sec 

7/24C 

SL 

C gyro 

5*/hr 

1392 

1443 

51 

.071* 


SL 

C accel. 

2 cffl/sec^ 

1599 

1619 

20 

.40 m/sec 


M,SL 

A gyro 

3* /hr 

1808 

1925 

117 

.097* 

7/29A 

M,SL 

C gyro 

3.5Vhr 

1308 

1394 

86 

.084* 


SL 

D gyro 

3“ /hr 

1433 

1568 

135 

.112* 

7/29B 

M 

C gyro (A) 

O.SVhr 

607 

— 

— 



M 

C gyro(B) 

1.5*/hr 

659 

902 

243 

.101" 

8/22B 

SL 

A gyro 

6167*/hr 

495 

495 

<1 

(.086*, 1.7*) 


SL 

B gyro 

6167*/hr 

516 

516 

<1 

(.086", 1.7") 


M 

A gyro 

6167*/hr 

1664 

1664 

£l 

(.086", 1.7") 


M 

B gyro 

6167* /hr 

1682 

1682 

<1 

(.086", 1.7") 

8/29B 

SL,M 

A gyro 

6Vhr 

675 

775 

100 

.167* 


SL 

B gyro 

24*/hr 

680 

691 

11 

.073* 

9/05A 

SL 

E gyro 

6* /hr 

1205 

1254 

49 

.082" 


SL 

F gyro 

24Vhr 

1211 

1222 

11 

.073* 

9/05B 

M 

A accel. 

1 cm/sec^ 

765 

863 

98 

.98 m/sec 


M 

B accel. 

4 cm/sec^ 

773 

863 

90 

3.6 m/sec 

9/05C 

M 

E gyro 

6Vhr 

595 

645 

50 

.083* 

9/05D 

M 

C accel. 

1 cm/sec^ 

488 

572 

84 

.84 m/sec 


M 

D accel. 

4 cm/ sec ^ 

500 

572 

72 

2. 88 m/sec 


^SL: Btralght-and-level flight; N: maneuvering flight. 
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In table 4, "Time In*' is the SIRU navigation time point at which a 
recorded keyboard entry indicated that the "failure" was inserted; this 
assumes no appreciable lag in changing the compensation. "Time Detected" is 
the navigation time point at which the failure status flags showed the correct 
sensor to have failed. "Undetected Duration" is the time interval during 
which the undetected failure was corrupting the attitude and navigation cal- 
culations. The notations "AAng" and "AV" are resultant angle and velocity 
errors computed by multiplying the level of failure by the undetected dura- 
tion. (Note: Approximately one-half of AAng or AV corrupts the attitude 

and navigation calculations because of the way hexad measurements are reduced 
to triad data in SIRU. Attitude and navigation errors are generally quite 
predictable from AAng and AV. ) 

The gyro error detection threshold was set to 1.14® /hr from considera- 
tions of minimizing operational false alarms during flight. The "detection 
threshold" is directly related to sensor random errors, uncompensated modeling 
errors, and dynamic digital system noise. 

The table shows that in every case but one the scheduled failed sensor was 
correctly isolated by the FDI algorithms even though unscheduled failures were 
present in many instances. In the one unsuccessful case, 0.5® /hr null bias 
shift was inserted into the A computer's compensation of the C gyro (x, y 
plane) during flight segment 7/29B and went undetected. The angle error, Ang, 
may be seen to be approximately constant in all cases except the computer 
failures of flight segment 8/22B. In that test, data reduction of the flight 
tape could not pinpoint the detection duration within 1 sec. If the failure 
were detected immediately, no angle error would result. If it were detected 
in 0.05 sec (SIRU’s computation update cycle), the error would be 0.0856®, and 
if detection required 1 sec, the error would be 1.7®. 

Figure 8 shows both the theoretical experimental failure detection and 
isolation of the attitude sensors as a function of failure magnitude. Also 
indicated in figure 8 are flight control application requirements of which 
inertlally smoothed landing guidance requires the shortest failure identifica- 
tion and removal time. 

As indicated in table 2, there were many unscheduled failures during the 
flights. The details of these failures are found in Volume II of this report. 
These failures were caused by the following: 

1. Improper sensor compensation 

• Human error 

• Calibration procedure 

• Poor error model 

2. Thermal conditions 

• Blowing cold air 

• Ambient temperature in excess of 88® F 

3. Other 

The above failure sources were largely removed as the flight program 
progressed. 
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The statistical portion of the FDI algorithm was removed after Flight 
7/17B because its operation was correlated with a high level of false alarms. 
The FDI algorithm will identify deficiencies in dynamic modeling errors by 
indicating a "failure” in the system. In order to reduce such false alarms, 
it would be necessary to increase the operating failure threshold to be com- 
patible with system dynamics of the flight environment. The maximum values of 
the gyro error measured in flight are compared with those found in the 
laboratory in the following table. 



Flight 

Laboratory 

Tarns 

Level flight 

2. 88“ /hr 
1.0“ /hr 

0.24“ /hr 
0.01“ /hr 


Thus, considerable improvement in the aircraft dynamic modeling is required 
before flight failure thresholds can be lowered to those obtained in the 
laboratory. 


Hardware and Software Limitations 

During flight tests in the CV-340 aircraft, certain limitations were 
experienced with respect to the SIRU hardware and software. These limitations 
are now summarized. 

Hardware limitations- The SIRU integrating rate gyro (IRIG 18 Mod B) was 
designed for continuous operation in a spacecraft environment. Because of the 
operational safety requirement to turn the system off when unattended, gyro 
parameter shifts were encountered across cooldown and powerdown; this neces- 
sitated frequent calibrations. The quantization level of 44 arc-sec was ade- 
quate for long-term space missions with periodic external updates, but not for 
the short-term hif.h-dynamic environment of the aircraft. The rate limitation 
of 1 rad/sec is no problem in a spacecraft, but does represent a limitation in 
an aircraft. A 2-hr warmup requirement prior to a 2-hr calibration is no 
problem in the long countdown of a spacecraft but is definitely unacceptable 
for an operational aircraft. 

The accelerometer (16 PM PIP) and its torque loop were more than adequate 
in all respects in the aircraft environment and therefore posed no limitation. 
Their calibration was stable over a period of 1 year. 

The SIRU sensor pallet mountir.g fixture was designed to permit calibra- 
tion of the SIRU sensors in the aircraft. It provided positioning of the 
inertial frame package to four cardinal points: 90® rotations about the sys- 

tem Z axis and one 90® rotation to put the Z axis in the vertical or horizon- 
tal plane. This permitted placing the ±X, ±Y, and +Z axes down individually 
for multiple position calibration. The tiwunting fixture did not allow a 
-Z axis down orientation. This missing sixth position would have improved the 
calibration accuracy. 
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A pair of wedge rings was provided to permit leveling the system prior to 
the aided single or multiple position test; however, the aircraft was off 
level more than these rings could compensate. It was necessary to jack up the 
nose of the aircraft by about 3® to put the sensor level within the compensa- 
tion range of the wedge rings. 

The sensor level was measured by a 10-arc-sec bubble mounted on the SIRU 
frame in a recessed well so that it could be rotated 360®. The 10-arc-sec 
bubble mounting surface had been precision-machined with respect to the system 
reference cube. With repeated operations, its aluminum surface became worn 
and the repeatability of the measured accelerometer biases was uncertain. 

The SIRU sensor pallet cooling system was limited to an ambient air tem- 
perature range of +40® to +88® F. The inertial component temperature con- 
trollers could not control the gyro and accelerometer temperatures outside 
this range. Lack of control caused sensor parameter shifts which would be 
detected by the FDI software as a transient sensor failure. The aircraft air 
conditioning system was inadequate in the early part of the flight test pro- 
gram and allowed ambient air temperatures to exceed 90®. It was never adequate 
when the aircraft was sitting on the ground and the outside air temperature 
exceeded 90®. Operation of the air conditioning required that one engine be 
running. This limited the accuracy of the calibration. The ground-support 
cooling system used to correct this problem caused overcooling of some inertial 
components when the cabin temperature was normal because the outlets of the 
aircraft air conditioning were exhausting cold air directly onto these inertial 
components, causing uncompensated temperature gradients in the sensors and 
thereby triggering a transient failure report from the FDI algorithm. This 
condition was corrected once the source of the problem had been isolated. 

Software limitations- Postflight analyses indicated that the base motion 
isolation software mechanization did not perform as well as expected and was 
the cause of excessive errors in estimates of north and level during fine 
alignment. 

Using computed body velocity at the end of each 1-sec navigation update 
to approximate the average velocity over that update period caused 
acceleration-induced position errors as large as 52 m for 180® turns. These 
errors averaged to zero for straight-line acceleration and deceleration. 

The statistical FDI algorithm threshold limits were specified to be 
1.5 times the standard deviation of the gyro error derived from the laboratory 
test environment. Flight test experience showed that the gyro errors were 
greatly increased as compared to the laboratory dynamic test data. The orig- 
inal limits were 0.06®/hr for static conditions and a maximum dynamic increase 
of 0.12®/hr to give a maximum threshold of 0.18®/hr. These were changed to 
0.48® /hr static and 0.96® /hr maximum dynamic increase to give a maximum 
threshold of 1.44® /hr. These increases were derived more intuitively than 
analytically and proved to be Inadequate as evidenced by the large number of 
**false** failures. The software was then modified to remove the statistical 
FDI in the navigation mode and therefore in the flight mode (after flight 717). 
The FDI algorithm was then totally dependent upon the TSE which had thresholds 
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of 1.14*/hr MASE and 1.48*/hr maximum dynamic increase to give a maximum 
threshold of 2.62®/hr. Later analysis showed that the statistical limits 
should have been 0.75“/hr static with a maximum dynamic increase of 1.65®/hr 
to give a maximum threshold of 2. 50® /hr for utilization of the statistical FBI 
during aircraft navigation. 

The TSE failure detection thresholds were initially determined on the 
basis of laboratory tests without compensation for aircraft dynamics. How- 
ever, the TSE threshold is environmentally sensitive. The initial gyro 
threshold was 0.76"/hr with a maximum dynamic increase of 0.81® /hr, resulting 
in a maximum threshold of 1.57®/hr. Early flight test data indicated false 
gyro "failures" were being triggered during aircraft turn maneuvers because 
these limits were low. The limits were raised to 1.14® /hr for the threshold 
and 1.98® /hr for the maximum dynamic increase, giving a maximum threshold of 
3.12®/hr. Also, the accelerometers, initially set at 0.4 cm/sec^ for the 
first- fail threshold and 0.13 cm/sec^ for the second-fall threshold were reset 
to 0.28 and 0.25 cm/sec^, respectively. These changes removed the false 
failure indications during aircraft maneuvers. 


CONCLUSIONS 


The following conclusions have been drawn from the program test results 
relative to each of the three principal objectives presented previously. 


Navigation System Performance 

For short-haul aircraft operations, free-inertial navigation accuracy of 
1 to 3 n. mi. /hr is generally acceptable. Test results showed that this 
performance level was achieved during cruise conditions. Navigation perfor- 
mance during terminal area maneuvers (Including degradation in the presence of 
scheduled and unscheduled failures) produced higher error buildup. However, 
even without preflight calibration, these error rates did not exceed 
5 n. ml. /hr. In stammary, it was demonstrated that a system like SIRU can 
provide the inertial navigation capability necessary for short-haul applica- 
tions. However, additional analysis, software design, and testing are 
required to minimize dynamic errors resulting from uncompensated Instrument 
misalignments and scale factor errors. 

The SIRU Navigation Analysis Program was modified to allow computation 
of navigation states by inertially smoothing DME radio data. An analysis of 
SlRU's potential for providing inertially smoothed radio navigation (i.e., 
aided-lnertial navigation) indicated that a DME/baroaltiweter/inertial system 
based on SIRU could easily maintain a navigation accuracy of a few hundred 
tDf.ters. For one flight, the maximum aided-inertlal root-sum-square position 
error was about 0.2 n. ml. compared to a free— inertial maximum error of 
3.7 n. mi. on the same flight. 
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As an auxiliary effort, some sensor data from the flight test program 
were analyzed to assess SIRU use for Integrated short-haul flight control 
applications. The SIRU gyro resolution was 44 arc-sec (0.0002 rad) per bit. 
Data analyses showed that the quantization-derived digital noise from the 
44-arc-sec/blt resolution would prohibit use of such data In short-haul flight 
control systems. Also, the system's full-scale gyro measurement capacity of 
1 rad/sec is too low for many flight control applications. Scale changing to 
achieve higher full scale without increasing the word length would Increase 
the quantization error. Current flight control technology can produce 
1.6 arc-sec quantization at 2 rad/sec full-scale output* Thus, substantial 
modification to both hardware and software of SIRU would be required to allow 
flight control use. 


Failure Detection and Isolation Algorithm Performance 

The analysis of the flight data was directed towards comparing the experi- 
mentally measured failure isolation time with the theoretical isolation time. 
This comparison Is related to the digital system noise derived from motion 
dynamics. Its assessment provides technical insight for assessing other 
redundancy management strategies for short-haul avionics. 

The torque rebalance loops used in SIRU (dictated by Apollo technology) 
were tailored to 44 arc-sec angular resolution for the original spacecraft 
application* This size was coo large for aircraft operations. Included in 
figure 8 is a theoretical 1.6-arc-sec resolution (available in current inertial 
navigation system technology) plot of attitude failure rate versus failure 
identification and removal tin£. Such resolution would provide considerably 
better results. 

A redundant strapdown system should be able to isolate a navigation error 
of 28 n. mi. in 4 hr (trans-Atlantic criterion) which corresponds to approxi- 
mately a constant 0.1®/hr attitude failure rate. The SIRU flight experiments 
showed that achieving a 0.1® /hr failure detection and isolation is more diffi- 
cult than originally projected for aircraft operations. It was not possible 
to isolate sensor failures smaller than 1.6®/hr because the detection threshold 
had to be adjusted to a higher value to avoid false alarms. This threshold was 
approximately a factor of 30 larger than the laboratory sensor drift measure- 
ment. This experimentally measured threshold indicated that the SIRU system 
can detect and Isolate only hard failures for inertial navigation but may pro- 
vide reliable operation for flight control purposes. 

In reviewing these results, it must be remembered that the SIRU concept 
was originally designed as a redundant strapdown replacement for the Apollo 
spacecraft glmballed Inertial measurement unit. The resulting operational, 
electrical, mechanical, environmental, and mission Interface requirements were 
distinctly different from those which existed in the CV-340 aircraft. 

The flight test results have shown the limitations of the existing SIRU 
hardware and software design for short-haul transportation application. The 
results point out areas where additional design and verification efforts are 
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required before a redundant strapdo%m system can be considered for opera- 
tional usage. The fault detection and isolation capability is the area in 
need of the most work if the SIRU concepts are to become applicable for short- 
haul aircraft. 


Dual Computer System Reliability 

The design of the SIRU dual computer system is basically a good one from 
the standpoints of both correctness and reliability. Its strong points are 
the intermodule isolation, the intercomputer conanunication protocol, the wide 
variety of error detectors, and the effectiveness of the arbiter function. 

The SIRU conq>uter arrangement also has several weak points which do not affect 
the normal operation of the system, but do suggest design improvements which 
could Improve the overall reliability and maintainability of future systems. 
These Include the self-tests as applied to failure recovery, the computer 
software structures, the preflight test facilities, the use of different com- 
ponents, and an extension of the arbiter function (refs. 7 and 8). Elabora- 
tion on each of these points is presented in Volume II of this report. 

The principal difficulty with the SIRU dual computer system is the 
inability to correct for transient faults which "reprogram" the computer mem- 
ory (l.e., an intermittant connection In a "sense" or "write" amplifier) or 
the occurrence of multiple faults. When the transient fault is inactive after 
modifying memory, the computer self-diagnostic routines will Incorrectly 
recertify it, but the arbiter will show computer disagreen^nt and no method of 
identifying the correctly programmed computer. 

The SIRU preflight test system was designed in such a way that the parity 
checker, the bit-correct, and the clock-active error detectors could not be 
adequately tested. Details for necessary preflight testing and how system 
improvements could be made are also discussed in Volume II of this report. 
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Figure 1.- Flight test orientation of SIRU dodecahedron hexad 



Figure 2.- Ames Research Center CV-340 test aircraft with SIRU system installed 
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Figure 3.- Visual landmarks for the CV-340 flight test 



Latituda, dafl 





Horizontal 



Figure 5.- Terminal area pattern near Crows NALF. 
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